WO2017028642A1 - 一种存储器访问控制方法和装置、计算机存储介质 - Google Patents

一种存储器访问控制方法和装置、计算机存储介质 Download PDF

Info

Publication number
WO2017028642A1
WO2017028642A1 PCT/CN2016/089492 CN2016089492W WO2017028642A1 WO 2017028642 A1 WO2017028642 A1 WO 2017028642A1 CN 2016089492 W CN2016089492 W CN 2016089492W WO 2017028642 A1 WO2017028642 A1 WO 2017028642A1
Authority
WO
WIPO (PCT)
Prior art keywords
memory
access
read
write
rule
Prior art date
Application number
PCT/CN2016/089492
Other languages
English (en)
French (fr)
Inventor
王永
位国清
Original Assignee
深圳市中兴微电子技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 深圳市中兴微电子技术有限公司 filed Critical 深圳市中兴微电子技术有限公司
Publication of WO2017028642A1 publication Critical patent/WO2017028642A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F12/00—Accessing, addressing or allocating within memory systems or architectures
    • G06F12/14—Protection against unauthorised use of memory or access to memory
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules

Definitions

  • the present invention relates to memory access control technologies, and in particular, to a memory access control method and apparatus, and a computer storage medium.
  • a memory controller such as a Double Rate Synchronous Dynamic Random Access Memory (DDR) controller or an Embedded Multi Media Card (EMMC) controller does not support de-encryption, specifically, advanced reduced instruction set processing.
  • DDR Double Rate Synchronous Dynamic Random Access Memory
  • EMMC Embedded Multi Media Card
  • IP Intelligent Peripheral
  • TZC-380/TZC-400 can be used to protect DDR, but there is no de-encryption function
  • storage adapter BP141 can be used to protect static random access Take the memory (SRAM, Static Random Access Memory), but it does not have the de-encryption function.
  • embodiments of the present invention are expected to provide a memory access control method and apparatus, and a computer storage medium, which can improve the security of memory access.
  • the embodiment of the invention provides a memory access control method, including:
  • the data to be written to the memory is encrypted and written to the memory, or the data is read from the memory and the read data is decrypted.
  • the determining, according to the memory access command, whether the user has the right to access the memory includes: determining whether to have the right to access the memory based on the memory access command and the preset access rule.
  • the memory access command includes at least one of the following: an ID of the access source, an access indication identifier, and the access indication identifier is a read access indication identifier or a write access indication identifier;
  • the preset access rule includes at least one of the following rules: an ID access rule, a read/write access rule, and a protection rule;
  • the ID access rule is configured to allow access to the memory when the ID of the access source belongs to an ID capable of accessing the memory; when the ID of the access source does not belong to an ID capable of accessing the memory, the memory is not allowed to be performed access;
  • the read/write access rule is configured to set a read/write permission of the memory, and allow access to the memory when the memory access command matches the read/write permission of the set memory; and the memory access command and the set are Memory access is not allowed when the read and write permissions of the memory do not match;
  • the protection rule is configured to set a protection identifier of the memory, allowing access to the memory when the read access indication identifier matches the protection identifier of the memory, or when the write access indication identifier matches the protection identifier of the memory;
  • the command is a read access command
  • the read access indication identifier does not match the protection identifier of the memory
  • access to the memory is not allowed
  • the memory access command is a write access command
  • the write access indication identifier does not match the protection identifier of the memory, Access to the memory is not allowed.
  • the method further includes before determining whether to have access to the memory. Dividing the memory into a plurality of regions according to the address of the memory;
  • the memory access command includes a memory access address, and further includes at least one of the following: an ID of the access source, an access indication identifier, the memory access address being an address in the memory or a data write address of the memory.
  • the access indication identifier is a read access indication identifier or a write access indication identifier;
  • the preset access rule includes at least one of the following rules: an ID access rule, a read/write access rule, and a protection rule;
  • the ID access rule includes an ID access sub-rule of each area of the memory; an ID access sub-rule of each area of the memory is used in the memory corresponding area in the memory corresponding area, and the ID of the access source belongs to the accessible memory corresponding When the ID of the area is allowed to access the memory; when the memory access address is in the corresponding area of the memory, and the ID of the access source does not belong to the ID capable of accessing the corresponding area of the memory, access to the memory is not allowed;
  • the read-write access rule includes a read-write access sub-rule of each area of the memory; the read-write access sub-rule of each area of the memory is used to set read and write permissions of the corresponding area of the memory, and the memory access command and the memory access command When the read/write permission of the area where the memory access address is matched, the memory is allowed to access; when the memory access command does not match the read/write right of the area where the memory access address is located, access to the memory is not allowed;
  • the protection rule includes a protection sub-rule of each area of the memory; a protection sub-rule of each area of the memory is used to set a protection identifier of a corresponding area of the memory, where the memory access address is in a corresponding area of the memory, and the access indication identifier is When the protection identifier of the area where the memory access address is matched, the memory is allowed to access; when the memory access address is in the corresponding area of the memory, and the access indication identifier does not match the protection identifier of the area where the memory access address is located, access to the memory is not allowed. .
  • the data to be written into the memory is encrypted and then written into the memory, and the data to be written into the memory is encrypted by using an advanced encryption standard AES or a data encryption standard DES encryption algorithm, and the encrypted ciphertext is written.
  • the reading of data from the memory and decrypting the read data includes decrypting the data read from the memory using an AES or DES decryption algorithm.
  • the data to be written into the memory is encrypted and then written into the memory, and the data to be written into the memory is encrypted by using an online encryption method
  • the reading data from the memory and decrypting the read data includes: decrypting the data read from the memory by using an online decryption method.
  • the embodiment of the invention further provides a memory access control device, comprising: a slave interface module, an access control module, an encryption and decryption module and a host interface module; wherein
  • a slave interface module configured to obtain a memory access command
  • An access control module configured to determine whether to have access to the memory based on the memory access command
  • An encryption and decryption module configured to decrypt data read from the memory or to encrypt data to be written to the memory when determining to have access to the memory
  • the host interface module is configured to write the encrypted data to be written to the memory to the memory, or to read the data from the memory when determining the right to access the memory.
  • the access control module is further configured to determine whether to have permission to access the memory based on the memory access command and a preset access rule.
  • the memory access command includes at least one of the following: an ID of the access source, an access indication identifier, and the access indication identifier is a read access indication identifier or a write access indication identifier;
  • the preset access rule includes at least one of the following rules: an ID access rule, a read/write access rule, and a protection rule;
  • the ID access rule is configured to allow access to the memory when the ID of the access source belongs to an ID capable of accessing the memory; when the ID of the access source does not belong to an ID capable of accessing the memory, the memory is not allowed to be performed access;
  • the read/write access rule is configured to set a read/write permission of the memory, and allow access to the memory when the memory access command matches the read/write permission of the set memory; and the memory access command and the set are Memory access is not allowed when the read and write permissions of the memory do not match;
  • the protection rule is configured to set a protection identifier of the memory, allowing access to the memory when the read access indication identifier matches the protection identifier of the memory, or when the write access indication identifier matches the protection identifier of the memory;
  • the command is a read access command
  • the read access indication identifier does not match the protection identifier of the memory
  • access to the memory is not allowed
  • the memory access command is a write access command
  • the write access indication identifier does not match the protection identifier of the memory, Access to the memory is not allowed.
  • the access control module is further configured to divide the memory into a plurality of areas according to an address of the memory before determining whether to have permission to access the memory;
  • the memory access command includes a memory access address, and further includes at least one of the following: an ID of the access source, an access indication identifier, the memory access address being an address in the memory or a data write address of the memory.
  • the access indication identifier is a read access indication identifier or a write access indication identifier;
  • the preset access rule includes at least one of the following rules: an ID access rule, a read/write access rule, and a protection rule;
  • the ID access rule includes an ID access sub-rule of each area of the memory; an ID access sub-rule of each area of the memory is used in the memory corresponding area in the memory corresponding area, and the ID of the access source belongs to the accessible memory corresponding
  • the ID of the area allows access to the memory; the memory access address is in the memory corresponding area, and the ID of the access source does not belong to Access to the memory is not allowed when accessing the ID of the corresponding area of the memory;
  • the read-write access rule includes a read-write access sub-rule of each area of the memory; the read-write access sub-rule of each area of the memory is used to set read and write permissions of the corresponding area of the memory, and the memory access command and the memory access command When the read/write permission of the area where the memory access address is matched, the memory is allowed to access; when the memory access command does not match the read/write right of the area where the memory access address is located, access to the memory is not allowed;
  • the protection rule includes a protection sub-rule of each area of the memory; a protection sub-rule of each area of the memory is used to set a protection identifier of a corresponding area of the memory, where the memory access address is in a corresponding area of the memory, and the access indication identifier is When the protection identifier of the area where the memory access address is matched, the memory is allowed to access; when the memory access address is in the corresponding area of the memory, and the access indication identifier does not match the protection identifier of the area where the memory access address is located, access to the memory is not allowed. .
  • the access control module is further configured to determine that the access to the memory is authorized when each of the preset access rules allows access to the memory.
  • the encryption and decryption module is further configured to encrypt data to be written into the memory by using an advanced encryption standard AES or a data encryption standard DES encryption algorithm, or to use the AES or DES decryption algorithm to read data from the memory. Decrypt.
  • the encryption and decryption module is further configured to decrypt the data read from the memory by using an online decryption method, or encrypt the data to be written into the memory by using an online encryption method.
  • the embodiment of the present invention further provides a computer storage medium.
  • the computer storage medium provided by the embodiment of the present invention stores a computer program, and the computer program is used to execute the foregoing memory access control method.
  • a memory access control method and apparatus provided by an embodiment of the present invention, a computer storage medium, acquire a memory access command, and determine whether to have access storage based on the memory access command Permission of the device; when the permission to access the memory is determined, the data to be written to the memory is encrypted and written to the memory, or the data is read from the memory and the read data is decrypted.
  • the security of memory access can be improved by setting at least two access control policies.
  • FIG. 1 is a flowchart of a first embodiment of a memory access control method according to the present invention
  • FIG. 2 is a flowchart of a second embodiment of a memory access control method according to the present invention.
  • FIG. 3 is a flowchart of a third embodiment of a memory access control method according to the present invention.
  • FIG. 4 is a schematic structural diagram of a memory access control apparatus according to an embodiment of the present invention.
  • FIG. 1 is a flowchart of a first embodiment of a memory access control method according to the present invention. As shown in FIG. 1, the method includes:
  • Step 100 Obtain a memory access command.
  • the memory includes, but is not limited to, a dynamic random access memory (DRAM), a static random access memory (SRAM), a flash memory, and the like.
  • DRAM dynamic random access memory
  • SRAM static random access memory
  • flash memory and the like.
  • a memory access command from at least one upstream device can be received through the bus, and the bus for receiving the memory access command can support any of the following bus protocols: Advanced High Performance Bus (AHB, Advanced High Performance) Bus) protocol, Advanced Extensible Interface (AXI) bus protocol, ACE_Lite (AXI Coherency Extensions Lite) bus protocol.
  • AHB Advanced High Performance Bus
  • AXI Advanced Extensible Interface
  • ACE_Lite AXI Coherency Extensions Lite
  • the memory access command may be a read access command for reading memory data or A write access command for writing data to the memory; in an actual application, the memory access command includes an access type identifier for indicating whether the memory access command is a read access command or a write access command.
  • the memory access command when the memory access command is a write access command, the data to be written to the memory is also acquired while the memory access command is acquired.
  • the read access command includes an address of the data to be read in the memory, and at least one of the following information: an ID of the access source, a read access indication identifier, and the read access indication identifier,
  • an ID of the access source e.g., a read access indication identifier
  • the read access indication identifier e.g., a read access indication identifier
  • the protection identifier of each address in the memory may be set in advance, or the matching relationship between the protection identifier of each address in the memory and the read access indication identifier may be preset.
  • the read access indication identifier may include only one identifier, and may also include multiple identifiers.
  • the read access indication identifier includes at least one of the following identifiers: a security identifier, a privilege identifier.
  • the read access indication flag is explained below by way of example 1 and example 2.
  • Example 1 The protection of the address of the data to be read in the memory is identified as a security identifier, and if the read access indication identifier includes a security identifier, it indicates that the data can be read from the corresponding address of the memory; if there is no read access indication in the read access command The identification, or read access indication, does not include a security identity, indicating that data cannot be read from the corresponding address in the memory.
  • the protection identifier of the address of the data to be read in the memory includes a security identifier and a privilege identifier, and if the read access indication identifier includes a security identifier and a privilege identifier, it indicates that the data can be read from the corresponding address of the memory; There is no read access indication identifier in the read access command, or the read access indication identifier only includes the security identifier, or the read access indication identifier includes only the privilege identifier, indicating that the data cannot be read from the corresponding address of the memory.
  • the write access command includes a data write address, and at least one of the following information: an ID of the access source, a write access indication identifier, and the write access indication identifier, and the number
  • the protection flags of the write addresses match, it means that data can be written to the corresponding address of the memory; when it does not match the protection flag of the data write address, it means that data cannot be written to the corresponding address of the memory.
  • the protection identifier of each address in the memory may be set in advance, or the matching relationship between the protection identifier of each address in the memory and the write access indication identifier may be preset.
  • the write access indication identifier may include only one identifier, and may also include multiple identifiers.
  • the write access indication identifier includes at least one of the following identifiers: a security identifier, a privilege identifier.
  • the write access indication flag is explained below by way of Example 3 and Example 4.
  • the protection identifier of the data write address is a privilege identifier, and if the write access indication identifier includes the privilege identifier, it indicates that data can be written to the corresponding address of the memory; if the write access command does not include the write access indication identifier, or write access Indicating that the identifier does not include a privilege identifier indicates that data cannot be written to the corresponding address of the memory.
  • the protection identifier of the data write address includes a security identifier and a privilege identifier, and if the write access indication identifier includes a security identifier and a privilege identifier, it indicates that data can be written to the corresponding address of the memory; otherwise, if the write access command does not include The write access indication identifier, or the write access indication identifier includes only the security identifier, or the write access indication identifier includes only the privilege identifier, indicating that data cannot be written to the corresponding address of the memory.
  • Step 101 Determine whether there is permission to access the memory based on the memory access command.
  • This step can be implemented in at least two ways.
  • the step specifically includes determining whether to have access to the memory based on the memory access command and the preset access rule.
  • the preset access rule includes at least one of the following rules: an ID access rule, a read/write access rule, and a protection rule.
  • the ID access rule is configured to specify an ID capable of accessing the memory, and the storage is allowed when the ID of the access source in the memory access command belongs to the specified ID capable of accessing the memory.
  • the device accesses; when the ID of the access source in the memory access command does not belong to the specified ID capable of accessing the memory, access to the memory is not allowed. That is, according to the ID access rule, it is possible to know which ID can access the memory.
  • the read/write access rule is configured to set a read/write permission of the memory, and allow access to the memory when the memory access command matches the read/write permission of the set memory; and the memory access command and the set are Memory access is not allowed when the read and write permissions of the memory do not match.
  • the read/write permission of the set memory may be read-only, write-only, readable and writable, or unreadable or writable, when the memory access command is a read access command, and the read/write permission of the set memory is read-only.
  • the memory access command matches the read and write permissions of the set memory, the read and write access rules allow access to the memory; when the memory access command is a read access command, and the set memory
  • the read/write permission is write only or cannot be read or written, the memory access command does not match the read/write permission of the set memory, and the read/write access rule does not allow access to the memory.
  • the memory access command When the memory access command is a write access command, and the read/write permission of the set memory is write-only or readable and writable, the memory access command matches the read/write permission of the set memory, and the read-write access rule Allowing access to the memory; when the memory access command is a write access command, and the read and write permissions of the set memory are read-only or cannot be read or written, the read and write permissions of the memory access command and the set memory are not Matching, read and write access rules do not allow access to memory.
  • the memory can have different read and write permissions for different IDs.
  • the protection rule is configured to set a protection identifier of the memory, allowing access to the memory when the read access indication identifier and the protection identifier of the memory match, or when the write access indication identifier matches the protection identifier of the memory;
  • the command is a read access command If the read access indication identifier does not match the protection identifier of the memory, the protection rule does not allow access to the memory; if the memory access command is a write access command, if the write access indication identifier does not match the protection identifier of the memory, The protection rules do not allow access to the memory.
  • the matching relationship between the read access indication flag/write access indication flag and the protection identifier of the memory may be set in advance.
  • the protection identifier of the memory may be classified into four types.
  • the first protection identifier includes a security identifier and a privilege identifier
  • the second protection identifier includes only the security identifier
  • the third protection identifier includes only the privilege identifier
  • the fourth protection identifier is No logo.
  • the read access indication identifier or the write access indication identifier includes a security identifier and a privilege identifier
  • the memory having the first protection identifier, the second protection identifier, the third identifier, or the fourth protection identifier may be accessed; if the read access indication is The identifier or the write access indication identifier includes only the security identifier, and the memory having the second protection identifier or the fourth protection identifier may be accessed; if the read access indication identifier or the write access indication identifier includes only the privilege identifier, the access may have the third A memory that protects the identity or the fourth protection identity; if the read access indicator or the write access indicator does not include any identity, the memory with the fourth protection identity can be accessed.
  • the memory is divided into multiple regions according to the address of the memory, and the number of regions and the size of the region divided by the memory can be pre-configured, for example, the memory is divided into 16 regions, which are respectively represented as regions. 0 to area 15.
  • the step specifically includes determining whether to have access to the memory based on the memory access command and the preset access rule.
  • the preset access rule includes at least one of the following rules: an ID access rule for each area of the memory, a read/write access rule, and a protection rule. then.
  • the ID access rule includes an ID access sub-rule of each area of the memory; an ID access sub-rule of each area of the memory is used to specify an ID capable of accessing a corresponding area of the memory, where the memory access address is in a memory corresponding area, and
  • the ID of the access source belongs to the specified ID capable of accessing the corresponding area of the memory, access to the memory is permitted; when the memory access address is in the memory corresponding area, and the ID of the access source does not belong to the specified ID of the corresponding area capable of accessing the memory Access to the memory is not allowed; here, the memory access address is the address of the data to be read when the memory data is read in the memory or the data write address when the data is written to the memory. That is to say, according to the ID access sub-rule, it can be known which ID can access the corresponding area of the memory.
  • the read-write access rule includes a read-write access sub-rule of each area of the memory; the read-write access sub-rule of each area of the memory is used to set read and write permissions of the corresponding area of the memory, and the memory access command and the memory access command When the read/write permission of the area where the memory access address is matched, access to the memory is allowed; when the memory access command does not match the read/write right of the area where the memory access address is located, access to the memory is not allowed.
  • the read/write permission of each area of the set memory may be read-only, write-only, readable and writable, or unreadable or writable.
  • the memory access command is a read access command
  • the memory access address is in the area where the address is read or written.
  • the permission is read-only or readable and writable
  • the memory access command matches the read/write permission of the area where the memory access address is located, at this time, access to the memory is allowed; when the memory access command is a read access command, and the memory
  • the read/write permission of the area where the access address is located is write-only or cannot be read or written
  • the memory access command does not match the read/write permission of the area where the memory access address is located. At this time, access to the memory is not allowed.
  • the memory access command When the memory access command is a write access command, and the read/write permission of the area where the memory access address is located is write-only or readable and writable, the memory access command matches the read/write permission of the area where the memory access address is located, Allowing access to the memory; when the memory is accessed When the command is a write access command, and the read/write permission of the area where the memory access address is located is read-only or cannot be read or written, the memory access command does not match the read/write permission of the area where the memory access address is located. The memory is accessed.
  • each area of the memory can have different read and write permissions for different IDs.
  • the protection rule includes a protection sub-rule of each area of the memory; a protection sub-rule of each area of the memory is used to set a protection identifier of a corresponding area of the memory, where the memory access address is in a corresponding area of the memory, and the access indication identifier is When the protection identifier of the area where the memory access address is matched, the memory is allowed to access; when the memory access address is in the corresponding area of the memory, and the access indication identifier does not match the protection identifier of the area where the memory access address is located, access to the memory is not allowed.
  • the access indication is a read access indication identifier in the read access command or a write access indication identifier in the write access command.
  • the protection identifier of each area of the memory may be classified into four types.
  • the first protection identifier includes a security identifier and a privilege identifier
  • the second protection identifier includes only a security identifier
  • the third protection identifier includes only a privilege identifier
  • the fourth type The protection ID is no logo.
  • the area with the first protection identifier is referred to as the privileged security area
  • the area with the second protection identifier is referred to as the general security area
  • the area with the third protection identifier is referred to as the privileged common area, which will have the
  • the areas of the four protection marks are called general common areas.
  • the read access indication identifier or the write access indication identifier includes a security identifier and a privilege identifier
  • the privileged security zone, the general security zone, the privileged normal zone, or the general common zone may be accessed; if the read access indication identity or the write access indication identity includes only the security identity , the general security zone or the general common zone may be accessed; if the read access indication identifier or the write access indication identifier includes only the privilege identifier, the privileged normal zone or the general common zone may be accessed; if the read access indication identifier or the write access indication identifier does not include Any logo can access the general common area.
  • each area of the memory is only provided with one protection identifier, each in the memory.
  • the protection identifier of the address is the protection identifier of the area in which the corresponding address is located, that is, the protection identifier of each address is the same in each area of the memory.
  • the ID access rule, the read/write access rule, and the protection rule can be flexibly used together to implement an effective and feature-rich memory access control policy.
  • Step 102 When it is determined that the right to access the memory is obtained, the data to be written into the memory is encrypted and written into the memory, or the data is read from the memory and the read data is decrypted.
  • the data to be written into the memory is encrypted and then written into the memory, and the data to be written into the memory is encrypted into a ciphertext by using a preset key, and the ciphertext is sent to the memory.
  • Reading data from the memory and decrypting the read data includes reading the ciphertext in the memory and decrypting the ciphertext by a preset key. It can be seen that this step supports encrypting data written in the memory and supporting decryption of data read from the memory, and the data can be protected from being stolen by data encryption.
  • the encryption and decryption algorithms such as Advanced Encryption Standard (AES)/Data Encryption Standard (DES) can be used to encrypt and decrypt data; through high-performance AES/DES encryption and decryption algorithms, Encryption of data written in the memory cannot be cracked even if the data in the memory is illegally acquired, and corresponding decryption is performed when the data of the memory is read.
  • High-performance encryption and decryption algorithms ensure real-time encryption and decryption and reduce read and write delays.
  • the encryption algorithm and the decryption algorithm in this step need to be consistent.
  • the first method uses software de-encryption to perform de-encryption; the second method, The data is called to the de-encryption module by direct memory access (DMA) to perform hardware de-encryption.
  • DMA direct memory access
  • the data to be written into the memory may be encrypted by means of in-line encryption, and the data read from the memory may be decrypted by means of online decryption.
  • the online encryption and decryption method can save bus bandwidth and hardware overhead, and reduce power consumption.
  • the encrypted ciphertext is sent to the memory controller, and the writing of the memory data is implemented by the memory controller.
  • the memory controller may be a DRAM controller, an SRAM controller, or a flash controller.
  • the first embodiment of the memory access control method of the present invention can support multiple security control policies, and all memory accesses through the device undergo security check. These security control policies and permission checks conform to the multimedia in the ARM TrustZone trusted architecture. Protect the requirements for secure access to memory.
  • the memory access command is a write access command
  • the method 2 is used to determine whether there is permission to access the memory.
  • FIG. 2 is a flowchart of a second embodiment of a memory access control method according to the present invention. As shown in FIG. 2, the method includes:
  • Step 200 Configure access control parameters.
  • the access control parameters include area control parameters, ID control parameters, read and write control parameters, Protection control parameters and encryption and decryption parameters.
  • the area control parameter includes the number of areas and the area size divided by the memory;
  • the ID control parameter includes an ID access parameter of each area of the memory, and the ID access parameter of each area of the memory includes an ID capable of accessing the corresponding area of the memory;
  • the write control parameters include read and write permissions for each area of the memory;
  • the protection control parameters include protection identifiers for each area of the memory;
  • the encryption and decryption parameters include encryption methods and keys.
  • Step 201 Receive a memory access command and data to be written to the memory.
  • the memory access command is a write access command.
  • the write access command from the master device and the data to be written to the memory can be received through the bus.
  • Step 202 Determine whether there is permission to access the memory based on the memory access command.
  • This step is the same as the implementation process of step 101, and will not be described in detail herein.
  • Step 203 When it is determined that the right to access the memory is obtained, the data to be written into the memory is encrypted into a ciphertext according to the encryption and decryption parameters.
  • Step 204 Encapsulate the write access command and the ciphertext according to the bus protocol, and send the encapsulated data to the memory.
  • the memory access command is a read access command
  • the method 2 is used to determine whether there is a right to access the memory.
  • FIG. 3 is a flowchart of a third embodiment of a memory access control method according to the present invention. As shown in FIG. 3, the method includes:
  • Step 300 Configure access control parameters.
  • the access control parameters include area control parameters, ID control parameters, read and write control parameters, Protection control parameters and encryption and decryption parameters.
  • the area control parameter includes the number of areas and the area size divided by the memory;
  • the ID control parameter includes an ID access parameter of each area of the memory, and the ID access parameter of each area of the memory includes an ID capable of accessing the corresponding area of the memory;
  • the write control parameters include read and write permissions of each area of the memory;
  • the protection control parameters include protection identifiers for each area of the memory;
  • the encryption and decryption parameters include a decryption method and a key.
  • Step 301 Receive a memory access command.
  • the memory access command is a read access command, and in this step, a read access command from the master device can be received through the bus.
  • Step 302 Determine whether to have permission to access the memory based on the memory access command.
  • This step is the same as the implementation process of step 101, and will not be described in detail herein.
  • Step 303 When it is determined that the right to access the memory is obtained, the ciphertext is read from the memory.
  • Step 304 Decrypt the ciphertext according to the encryption and decryption parameters.
  • an embodiment of the present invention further provides a memory access control apparatus.
  • the apparatus includes: a slave interface module 400, an access control module 401, an encryption and decryption module 402, and a host interface module 403;
  • the slave interface module 400 is configured to acquire a memory access command.
  • the access control module 401 is configured to determine whether to have access to the memory based on the memory access command.
  • the encryption/decryption module 402 is configured to decrypt data read from the memory or to encrypt data to be written to the memory when determining the right to access the memory.
  • the host interface module 403 is configured to write the encrypted data to be written into the storage into the storage Reads data from memory when it is determined that it has access to the memory.
  • the access control module 401 is further configured to determine whether to have access to the memory based on the memory access command and a preset access rule.
  • the memory access command includes a memory access address, and further includes at least one of the following: an ID of the access source, an access indication identifier, the memory access address being an address in the memory or a data write address of the memory.
  • the access indication identifier is a read access indication identifier or a write access indication identifier.
  • the preset access rule includes at least one of the following rules: an ID access rule, a read/write access rule, and a protection rule.
  • the ID access rule is configured to allow access to the memory when the ID of the access source belongs to an ID capable of accessing the memory; when the ID of the access source does not belong to an ID capable of accessing the memory, the memory is not allowed to be performed access.
  • the read/write access rule is configured to set a read/write permission of the memory, and allow access to the memory when the memory access command matches the read/write permission of the set memory; and the memory access command and the set are Memory access is not allowed when the read and write permissions of the memory do not match;
  • the protection rule is configured to set a protection identifier of the memory, allowing access to the memory when the read access indication identifier matches the protection identifier of the memory, or when the write access indication identifier matches the protection identifier of the memory;
  • the command is a read access command
  • the read access indication identifier does not match the protection identifier of the memory
  • access to the memory is not allowed
  • the memory access command is a write access command
  • the write access indication identifier does not match the protection identifier of the memory, Access to the memory is not allowed.
  • the access control module 401 is further configured to divide the memory into a plurality of regions according to an address of the memory before determining whether to have access to the memory.
  • the memory access command includes a memory access address, and further includes at least one of the following information: The ID of the access source, the access indication identifier, the address of the data to be read in the memory or the data write address of the memory; the access indication identifier is a read access indication identifier or a write access indication identifier.
  • the preset access rule includes at least one of the following rules: an ID access rule, a read/write access rule, and a protection rule.
  • the ID access rule includes an ID access sub-rule of each area of the memory; an ID access sub-rule of each area of the memory is used in the memory corresponding area in the memory corresponding area, and the ID of the access source belongs to the accessible memory corresponding
  • the ID of the area is allowed to access the memory; when the memory access address is in the memory corresponding area, and the ID of the access source does not belong to the ID capable of accessing the corresponding area of the memory, access to the memory is not allowed.
  • the read-write access rule includes a read-write access sub-rule of each area of the memory; the read-write access sub-rule of each area of the memory is used to set read and write permissions of the corresponding area of the memory, and the memory access command and the memory access command When the read/write permission of the area where the memory access address is matched, access to the memory is allowed; when the memory access command does not match the read/write right of the area where the memory access address is located, access to the memory is not allowed.
  • the protection rule includes a protection sub-rule of each area of the memory; a protection sub-rule of each area of the memory is used to set a protection identifier of a corresponding area of the memory, where the memory access address is in a corresponding area of the memory, and the access indication identifier is When the protection identifier of the area where the memory access address is matched, the memory is allowed to access; when the memory access address is in the corresponding area of the memory, and the access indication identifier does not match the protection identifier of the area where the memory access address is located, access to the memory is not allowed. .
  • the access control module 401 is further configured to determine that the access to the memory is authorized when each of the pre-set access rules allows access to the memory.
  • the encryption and decryption module 402 is further configured to encrypt data to be written into the memory by using an AES or DES encryption algorithm, or read from the memory by using an AES or DES decryption algorithm. The data is decrypted.
  • the encryption and decryption module 402 is further configured to decrypt the data read from the memory by using an online decryption method, or encrypt the data to be written into the memory by using an online encryption method.
  • the memory access control apparatus of the embodiment of the present invention further includes a processor interface module 404 and a control unit module 405;
  • the processor interface module 404 is configured to receive the access control parameters and send the access control parameters to the control unit module; here, the specific content of the access control parameters has been illustrated in various embodiments of the memory access control method of the present invention, where No longer detailed.
  • the processor interface module 404 is further configured to receive a status parameter from the control unit module, where the status parameter of the control unit module is used to indicate an operating status of the current control unit.
  • the processor interface module 404 can receive access control parameters through a bus protocol such as AXI, AHB, and APB.
  • a bus protocol such as AXI, AHB, and APB.
  • the processor interface module receives an access control parameter of an external device such as a processor, only when the external device interfaces with the processor When the access of the module is secure access, the processor interface module receives the access control parameter. Otherwise, when the access of the external device to the processor interface module is non-secure access, the processor interface module does not receive the access control parameter, and then processing The interface module returns an error response and an interrupt to the external device.
  • the memory access control device of the embodiment of the present invention can be placed in a secure area, which can meet the requirements that the security control logic can only be securely accessed in the requirements of the ARM TrustZone trusted architecture.
  • the control unit module 405 is configured to control the access control module and the encryption and decryption module according to the received access control parameter; specifically, the control unit module sends the encryption and decryption parameters in the access control parameter to the encryption and decryption module, and The other parameters in the access control parameters are sent to the access control module; thus, the control unit module and the encryption and decryption module can be used to implement data encryption and decryption control, and the control unit module and the access control module can implement multiple access control strategies. .
  • the slave interface module 400 is configured to implement the memory access control device of the embodiment of the present invention.
  • the access command is sent to the access control module, and the data to be written to the memory is sent to the encryption and decryption module.
  • the access control module 401 is further configured to determine, according to the write access command, whether to have the right to access the memory when receiving the write access command; and to send the write access permission command to the add when determining the right to access the memory Decrypting module and slave interface module, and sending a write access command to the host interface module; when determining that there is no access to the memory, respectively sending a write access rejection instruction to the encryption and decryption module and the slave interface module, and the write interface is not sent at this time The access command is sent to the host interface module.
  • the slave interface module 400 is configured to send a write access success response to the master device after receiving the write access permission command; the slave interface module sends a write access error response to the master after receiving the write access rejection command device.
  • the encryption and decryption module 402 is configured to, after receiving the write access permission instruction, encrypt the data to be written into the memory according to the encryption and decryption parameter, and send the encrypted ciphertext to the host interface module; the encryption and decryption module After receiving the write access rejection command, no processing is performed on the data written to the memory.
  • the host interface module 403 is configured to encapsulate the received write access command and the ciphertext according to the bus protocol, and send the encapsulated data to the memory. Specifically, the host interface module sends the encapsulated data to the memory controller, and the memory controller writes the ciphertext to the memory according to the encapsulated data.
  • the access control module 401 is further configured to determine, according to the read access command, whether to have the right to access the memory when receiving the read access command; and to send the read access permission command to the add when determining the right to access the memory Decrypting module and slave interface module, and sending read access command to host interface module; sending separately when determining that there is no access to memory
  • the read access reject command is sent to the encryption and decryption module and the slave interface module, and no read access command is sent to the host interface module at this time.
  • the slave interface module 400 is configured to send a read access error response to the master device upon receiving the read access reject command.
  • the host interface module 403 is configured to read the corresponding ciphertext from the memory according to the bus protocol and the received read access command, and send the read ciphertext to the encryption and decryption module. Specifically, the host interface module utilizes memory control to read the ciphertext stored in the memory.
  • the encryption and decryption module 402 is configured to, after receiving the read access permission command, decrypt the received ciphertext according to the encryption and decryption parameters, and send the decrypted data to the slave interface.
  • the slave interface module 400 is configured to, when receiving the decrypted data, send the decrypted data and the read access success to the master device.
  • the host interface module can implement data interaction with the memory controller through a bus protocol such as AXI, AHB, and APB.
  • the memory access control apparatus of the embodiment of the present invention can support access of multiple master devices.
  • a slave interface module and an access control module are respectively set for each master device.
  • the slave interface module 400, the access control module 401, the encryption and decryption module 402, the host interface module 403, the processor interface module 404, and the control unit module 405 may each be a central processor located in the terminal device (Central) A processing unit (CPU), a microprocessor (Micro Processor Unit, MPU), a digital signal processor (DSP), or a Field Programmable Gate Array (FPGA).
  • CPU Central
  • MPU Micro Processor Unit
  • DSP digital signal processor
  • FPGA Field Programmable Gate Array
  • the memory access control device is in the form of a software function module. It can also be stored on a computer readable storage medium when sold or used as a standalone product. Based on such understanding, the technical solution of the embodiments of the present invention may be embodied in the form of a software product in essence or in the form of a software product stored in a storage medium, including a plurality of instructions.
  • a computer device (which may be a personal computer, server, or network device, etc.) is caused to perform all or part of the methods described in various embodiments of the present invention.
  • the foregoing storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read only memory (ROM), a magnetic disk, or an optical disk.
  • embodiments of the invention are not limited to any specific combination of hardware and software.
  • an embodiment of the present invention further provides a computer storage medium, wherein a computer program for executing a memory access control method of an embodiment of the present invention is stored.
  • embodiments of the present invention can be provided as a method, system, or computer program product. Accordingly, the present invention can take the form of a hardware embodiment, a software embodiment, or a combination of software and hardware. Moreover, the invention can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage and optical storage, etc.) including computer usable program code.
  • the computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the computer is readable and stored
  • the instructions in the reservoir produce an article of manufacture comprising an instruction device that implements the functions specified in one or more blocks of the flow or in a flow or block diagram of the flowchart.
  • These computer program instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for execution on a computer or other programmable device.
  • the instructions provide steps for implementing the functions specified in one or more of the flow or in a block or blocks of a flow diagram.
  • the technical solution of the embodiment of the present invention acquires a memory access command, determines whether the user has the right to access the memory based on the memory access command, and determines that the data to be written into the memory is encrypted and then written into the memory. Or read data from memory and decrypt the read data.
  • the security of memory access can be improved by setting at least two access control policies.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Computer Hardware Design (AREA)
  • Software Systems (AREA)
  • Storage Device Security (AREA)

Abstract

一种存储器访问控制方法、存储器访问控制装置、计算机存储介质，该方法包括：获取存储器访问命令（100）；基于所述存储器访问命令，确定是否具有访问存储器的权限（101）；确定具有访问存储器的权限时，将待写入存储器的数据进行加密后写入存储器，或者从存储器中读取数据并对读取出的数据进行解密（102）。

Description

一种存储器访问控制方法和装置、计算机存储介质 技术领域
本发明涉及存储器访问控制技术，尤其涉及一种存储器访问控制方法和装置、计算机存储介质。
背景技术
对于存储器来说，为防止存储器数据泄露而采取的安全措施越来越受到重视。通常存储器控制器如双倍速率同步动态随机存储器(DDR，Double Data Rate)控制器或嵌入式多媒体卡(EMMC，Embedded Multi Media Card)控制器不支持解加密功能，具体地，高级精简指令集处理器(ARM，Advanced RISC Machines)处理器的智能外设(IP，Intelligent Peripheral)TZC-380/TZC-400可以用于保护DDR，但是没有解加密功能；而存储适配器BP141可以用于保护静态随机存取存储器(SRAM，Static Random Access Memory)，但是也不具备解加密功能。
现有技术中，可以实现对从存储器读取的数据或写入存储器的数据进行解加密，但是，在对存储器进行访问时，存储器的访问控制策略设置的比较简单，例如，存储器只通过解加密功能来进行访问控制，如此，会对存储器数据的安全性造成影响。
发明内容
为解决上述技术问题，本发明实施例期望提供一种存储器访问控制方法和装置、计算机存储介质，可以提高存储器访问的安全性。
本发明实施例提供了一种存储器访问控制方法，包括：
获取存储器访问命令；
基于所述存储器访问命令，确定是否具有访问存储器的权限；
确定具有访问存储器的权限时，将待写入存储器的数据进行加密后写入存储器，或者从存储器中读取数据并对读取出的数据进行解密。
上述方案中，所述基于所述存储器访问命令，确定是否具有访问存储器的权限，包括：基于所述存储器访问命令和预先设置的访问规则，确定是否具有访问存储器的权限。
上述方案中，所述存储器访问命令包括以下至少一种信息：访问源的ID、访问指示标识，所述访问指示标识为读访问指示标识或写访问指示标识；
所述预先设置的访问规则包括以下至少一种规则：ID访问规则、读写访问规则、保护规则；
所述ID访问规则，用于在所述访问源的ID属于能够访问存储器的ID时，允许对存储器进行访问；在所述访问源的ID不属于能够访问存储器的ID时，不允许对存储器进行访问；
所述读写访问规则，用于设置存储器的读写权限，在所述存储器访问命令与所设置的存储器的读写权限相匹配时，允许对存储器进行访问；在所述存储器访问命令与所设置的存储器的读写权限不匹配时，不允许对存储器进行访问；
所述保护规则，用于设置存储器的保护标识，在读访问指示标识与存储器的保护标识相匹配时，或者在写访问指示标识与存储器的保护标识相匹配时，允许对存储器进行访问；在存储器访问命令为读访问命令，且读访问指示标识与存储器的保护标识不匹配时，不允许对存储器进行访问；在存储器访问命令为写访问命令，且写访问指示标识与存储器的保护标识不匹配时，不允许对存储器进行访问。
上述方案中，在确定是否具有访问存储器的权限之前，所述方法还包 括按照存储器的地址将存储器划分为多个区域；
所述存储器访问命令包括存储器访问地址，还包括以下至少一种信息：访问源的ID、访问指示标识，所述存储器访问地址为所要读取的数据在存储器中的地址或存储器的数据写入地址；所述访问指示标识为读访问指示标识或写访问指示标识；
所述预先设置的访问规则包括以下至少一种规则：ID访问规则、读写访问规则、保护规则；
所述ID访问规则，包括存储器每个区域的ID访问子规则；所述存储器每个区域的ID访问子规则，用于在存储器访问地址处于存储器对应区域，且访问源的ID属于能够访问存储器对应区域的ID时，允许对存储器进行访问；在存储器访问地址处于存储器对应区域，且访问源的ID不属于能够访问存储器对应区域的ID时，不允许对存储器进行访问；
所述读写访问规则，包括存储器每个区域的读写访问子规则；所述存储器每个区域的读写访问子规则，用于设置存储器对应区域的读写权限，在所述存储器访问命令与存储器访问地址所在区域的读写权限相匹配时，允许对存储器进行访问；在所述存储器访问命令与存储器访问地址所在区域的读写权限不匹配时，不允许对存储器进行访问；
所述保护规则，包括存储器每个区域的保护子规则；所述存储器每个区域的保护子规则，用于设置存储器对应区域的保护标识，在存储器访问地址处于存储器对应区域，且访问指示标识与存储器访问地址所在区域的保护标识相匹配时，允许对存储器进行访问；在存储器访问地址处于存储器对应区域，且访问指示标识与存储器访问地址所在区域的保护标识不匹配时，不允许对存储器进行访问。
上述方案中，当所述预先设置的访问规则中的每种规则均允许对存储器进行访问时，确定具有访问存储器的权限。
上述方案中，所述将待写入存储器的数据进行加密后写入存储器包括：采用高级加密标准AES或数据加密标准DES加密算法对待写入存储器的数据进行加密，将加密后的密文写入存储器；
所述从存储器中读取数据并对读取出的数据进行解密，包括：采用AES或DES解密算法对从存储器中读取出的数据进行解密。
上述方案中，所述将待写入存储器的数据进行加密后写入存储器包括：采用在线加密方式对待写入存储器的数据进行加密；
所述从存储器中读取数据并对读取出的数据进行解密，包括：采用在线解密方式对从存储器中读取出的数据进行解密。
本发明实施例还提供了一种存储器访问控制装置，包括：从机接口模块、访问控制模块、加解密模块和主机接口模块；其中，
从机接口模块，配置为获取存储器访问命令；
访问控制模块，配置为基于所述存储器访问命令，确定是否具有访问存储器的权限；
加解密模块，配置为对从存储器中读取的数据进行解密，或者在确定具有访问存储器的权限时，将待写入存储器的数据进行加密；
主机接口模块，配置为将加密后的待写入存储器的数据写入存储器，或者在确定具有访问存储器的权限时，从存储器中读取数据。
上述方案中，所述访问控制模块，还配置为基于所述存储器访问命令和预先设置的访问规则，确定是否具有访问存储器的权限。
上述方案中，所述存储器访问命令包括以下至少一种信息：访问源的ID、访问指示标识，所述访问指示标识为读访问指示标识或写访问指示标识；
所述预先设置的访问规则包括以下至少一种规则：ID访问规则、读写访问规则、保护规则；
所述ID访问规则，用于在所述访问源的ID属于能够访问存储器的ID时，允许对存储器进行访问；在所述访问源的ID不属于能够访问存储器的ID时，不允许对存储器进行访问；
所述读写访问规则，用于设置存储器的读写权限，在所述存储器访问命令与所设置的存储器的读写权限相匹配时，允许对存储器进行访问；在所述存储器访问命令与所设置的存储器的读写权限不匹配时，不允许对存储器进行访问；
所述保护规则，用于设置存储器的保护标识，在读访问指示标识与存储器的保护标识相匹配时，或者在写访问指示标识与存储器的保护标识相匹配时，允许对存储器进行访问；在存储器访问命令为读访问命令，且读访问指示标识与存储器的保护标识不匹配时，不允许对存储器进行访问；在存储器访问命令为写访问命令，且写访问指示标识与存储器的保护标识不匹配时，不允许对存储器进行访问。
上述方案中，所述访问控制模块，还配置为在确定是否具有访问存储器的权限之前，按照存储器的地址将存储器划分为多个区域；
所述存储器访问命令包括存储器访问地址，还包括以下至少一种信息：访问源的ID、访问指示标识，所述存储器访问地址为所要读取的数据在存储器中的地址或存储器的数据写入地址；所述访问指示标识为读访问指示标识或写访问指示标识；
所述预先设置的访问规则包括以下至少一种规则：ID访问规则、读写访问规则、保护规则；
所述ID访问规则，包括存储器每个区域的ID访问子规则；所述存储器每个区域的ID访问子规则，用于在存储器访问地址处于存储器对应区域，且访问源的ID属于能够访问存储器对应区域的ID时，允许对存储器进行访问；在存储器访问地址处于存储器对应区域，且访问源的ID不属于能够 访问存储器对应区域的ID时，不允许对存储器进行访问；
所述读写访问规则，包括存储器每个区域的读写访问子规则；所述存储器每个区域的读写访问子规则，用于设置存储器对应区域的读写权限，在所述存储器访问命令与存储器访问地址所在区域的读写权限相匹配时，允许对存储器进行访问；在所述存储器访问命令与存储器访问地址所在区域的读写权限不匹配时，不允许对存储器进行访问；
所述保护规则，包括存储器每个区域的保护子规则；所述存储器每个区域的保护子规则，用于设置存储器对应区域的保护标识，在存储器访问地址处于存储器对应区域，且访问指示标识与存储器访问地址所在区域的保护标识相匹配时，允许对存储器进行访问；在存储器访问地址处于存储器对应区域，且访问指示标识与存储器访问地址所在区域的保护标识不匹配时，不允许对存储器进行访问。
上述方案中，所述访问控制模块，还配置为在所述预先设置的访问规则中的每种规则均允许对存储器进行访问时，确定具有访问存储器的权限。
上述方案中，所述加解密模块，还配置为采用采用高级加密标准AES或数据加密标准DES加密算法对待写入存储器的数据进行加密，或者采用AES或DES解密算法对从存储器中读取的数据进行解密。
上述方案中，所述加解密模块，还配置为采用在线解密方式对从存储器中读取的数据进行解密，或者采用在线加密方式对待写入存储器的数据进行加密。
本发明实施例还提供了一种计算机存储介质，本发明实施例提供的计算机存储介质存储有计算机程序，该计算机程序用于执行上述存储器访问控制方法。
本发明实施例提供的种存储器访问控制方法和装置、计算机存储介质，获取存储器访问命令；基于所述存储器访问命令，确定是否具有访问存储 器的权限；确定具有访问存储器的权限时，将待写入存储器的数据进行加密后写入存储器，或者从存储器中读取数据并对读取出的数据进行解密。如此，通过设置至少两种访问控制策略，可以提高存储器访问的安全性。
附图说明
图1为本发明存储器访问控制方法的第一实施例的流程图；
图2为本发明存储器访问控制方法的第二实施例的流程图；
图3为本发明存储器访问控制方法的第三实施例的流程图；
图4为本发明实施例存储器访问控制装置的组成结构示意图。
具体实施方式
下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述。
第一实施例
图1为本发明存储器访问控制方法的第一实施例的流程图，如图1所示，该方法包括：
步骤100：获取存储器访问命令。
这里，存储器包括但不限于动态随机存取存储器(DRAM，Dynamic Random Access Memory)、静态随机存取存储器(SRAM，Static Random Access Memory)、闪存(Flash Memory)等等。
在实际应用中，可以通过总线接收来自至少一个主设备(Upstream device)的存储器访问命令，用于接收存储器访问命令的总线可以支持以下任意一种总线协议：高级高性能总线(AHB，Advanced High performance Bus)协议、先进型可扩展接口(AXI，Advanced extensible Interface)总线协议、ACE_Lite(AXI Coherency Extensions Lite)总线协议。
具体地，存储器访问命令可以是用于读取存储器数据的读访问命令或 用于向存储器写入数据的写访问命令；在实际应用中，存储器访问命令中包含访问种类标识，用于表明存储器访问命令时读访问命令还是写访问命令。在一实施方式中，存储器访问命令是写访问命令时，在获取存储器访问命令的同时，还获取待写入存储器的数据。
在实际应用中，读访问命令包括所要读取的数据在存储器中的地址，还包括以下至少一种信息：访问源的ID(Identification)、读访问指示标识，所述读访问指示标识，用于在与所要读取的数据在存储器中的地址的保护标识相匹配时，表示能够读取存储器相应地址的数据；在与所要读取的数据在存储器中的地址的保护标识不匹配时，表示不能够读取存储器相应地址的数据。这里，可以预先设置存储器中每个地址的保护标识，也可以预先设置存储器中每个地址的保护标识与读访问指示标识的匹配关系。
这里，读访问指示标识可以只包括一个标识，也可以包括多个标识。例如，读访问指示标识包括以下至少一种标识：安全标识、特权标识。
下面通过示例1和示例2对读访问指示标识进行说明。
示例1：所要读取的数据在存储器中的地址的保护标识为安全标识，如果读访问指示标识包括安全标识，则表示可以从存储器相应地址处读取数据；如果读访问命令中没有读访问指示标识，或读访问指示标识不包括安全标识，则表示不能从存储器相应地址处读取数据。
示例2：所要读取的数据在存储器中的地址的保护标识包括安全标识和特权标识，如果读访问指示标识包括安全标识和特权标识，则表示可以从存储器相应地址处读取数据；反之，如果读访问命令中没有读访问指示标识，或读访问指示标识只包括安全标识，或读访问指示标识只包括特权标识，则表示不能从存储器相应地址处读取数据。
在实际应用中，写访问命令包括数据写入地址，还包括以下至少一种信息：访问源的ID、写访问指示标识，所述写访问指示标识，用于在与数 据写入地址的保护标识相匹配时，表示能够向存储器的相应地址处写入数据；在与数据写入地址的保护标识不匹配时，表示不能够向存储器的相应地址处写入数据。这里，可以预先设置存储器中每个地址的保护标识，也可以预先设置存储器中每个地址的保护标识与写访问指示标识的匹配关系。
这里，写访问指示标识可以只包括一个标识，也可以包括多个标识。例如，写访问指示标识包括以下至少一种标识：安全标识、特权标识。
下面通过示例3和示例4对写访问指示标识进行说明。
示例3：数据写入地址的保护标识为特权标识，如果写访问指示标识包括特权标识，则表示能够向存储器的相应地址处写入数据；如果写访问命令不包括写访问指示标识，或写访问指示标识不包括特权标识，则表示不能够向存储器的相应地址处写入数据。
示例4：数据写入地址的保护标识包括安全标识和特权标识，如果写访问指示标识包括安全标识和特权标识，则表示能够向存储器的相应地址处写入数据；反之，如果写访问命令不包括写访问指示标识，或写访问指示标识只包括安全标识，或写访问指示标识只包括特权标识，则表示不能够向存储器的相应地址处写入数据。
步骤101：基于所述存储器访问命令，确定是否具有访问存储器的权限。
本步骤至少可以通过以下两种方法实现。
方法一：
本步骤具体包括：基于所述存储器访问命令和预先设置的访问规则，确定是否具有访问存储器的权限。这里，所述预先设置的访问规则包括以下至少一种规则：ID访问规则、读写访问规则、保护规则。
所述ID访问规则，用于规定能够访问存储器的ID，在所述存储器访问命令中的访问源的ID属于所规定的能够访问存储器的ID时，允许对存储 器进行访问；在所述存储器访问命令中的访问源的ID不属于所规定的能够访问存储器的ID时，不允许对存储器进行访问。也就是说，根据ID访问规则，可以获知哪个ID能够访问存储器。
所述读写访问规则，用于设置存储器的读写权限，在所述存储器访问命令与所设置的存储器的读写权限相匹配时，允许对存储器进行访问；在所述存储器访问命令与所设置的存储器的读写权限不匹配时，不允许对存储器进行访问。
具体地，所设置的存储器的读写权限可以是只读、只写、可读写或不能读写，当所述存储器访问命令为读访问命令，且所设置的存储器的读写权限是只读或可读写时，所述存储器访问命令与所设置的存储器的读写权限相匹配，读写访问规则允许对存储器进行访问；当所述存储器访问命令为读访问命令，且所设置的存储器的读写权限是只写或不能读写时，所述存储器访问命令与所设置的存储器的读写权限不匹配，读写访问规则不允许对存储器进行访问。
当所述存储器访问命令为写访问命令，且所设置的存储器的读写权限是只写或可读写时，所述存储器访问命令与所设置的存储器的读写权限相匹配，读写访问规则允许对存储器进行访问；当所述存储器访问命令为写访问命令，且所设置的存储器的读写权限是只读或不能读写时，所述存储器访问命令与所设置的存储器的读写权限不匹配，读写访问规则不允许对存储器进行访问。
可以看出，如果预先设置的访问规则包括ID访问规则和读写访问规则，可以实现存储器对不同的ID具有不同的读写权限。
所述保护规则，用于设置存储器的保护标识，在读访问指示标识和存储器的保护标识相匹配时，或者在写访问指示标识与存储器的保护标识相匹配时，允许对存储器进行访问；在存储器访问命令为读访问命令的情况 下，如果读访问指示标识与存储器的保护标识不匹配，则保护规则不允许对存储器进行访问；在存储器访问命令为写访问命令的情况下，如果写访问指示标识与存储器的保护标识不匹配，则保护规则不允许对存储器进行访问。这里，读访问指示标识/写访问指示标识与存储器的保护标识的匹配关系可以预先设置。
例如，存储器的保护标识可以分为四种，第一种保护标识包括安全标识和特权标识，第二种保护标识只包括安全标识，第三种保护标识只包括特权标识，第四种保护标识为无标识。如果读访问指示标识或写访问指示标识包括安全标识和特权标识，则可以访问具有第一种保护标识、第二种保护标识、第三种标识或第四种保护标识的存储器；如果读访问指示标识或写访问指示标识只包括安全标识，则可以访问具有第二种保护标识或第四种保护标识的存储器；如果读访问指示标识或写访问指示标识只包括特权标识，则可以访问具有第三种保护标识或第四种保护标识的存储器；如果读访问指示标识或写访问指示标识不包括任何标识，则可以访问具有第四种保护标识的存储器。
本步骤中，当所述预先设置的访问规则中的每种规则均允许对存储器进行访问时，确定具有访问存储器的权限；当所述预先设置的访问规则中的至少一种规则不允许对存储器进行访问时，确定没有访问存储器的权限。
方法二：
在本步骤之前，按照存储器的地址将存储器划分为多个区域，存储器所划分的区域个数和区域大小均可以进行预先配置，例如将存储器划分为16个区域，这16个区域分别表示为区域0到区域15。
本步骤具体包括：基于所述存储器访问命令和预先设置的访问规则，确定是否具有访问存储器的权限。这里，所述预先设置的访问规则包括以下至少一种规则：存储器每个区域的ID访问规则、读写访问规则、保护规 则。
所述ID访问规则，包括存储器每个区域的ID访问子规则；所述存储器每个区域的ID访问子规则，用于规定能够访问存储器对应区域的ID，在存储器访问地址处于存储器对应区域，且访问源的ID属于所规定的能够访问存储器对应区域的ID时，允许对存储器进行访问；在存储器访问地址处于存储器对应区域，且访问源的ID不属于所规定的能够访问存储器对应区域的ID时，不允许对存储器进行访问；这里，所述存储器访问地址为读取存储器数据时所要读取的数据在存储器中的地址或向存储器写入数据时的数据写入地址。也就是说，根据ID访问子规则，可以获知哪个ID能访问存储器的对应区域。
所述读写访问规则，包括存储器每个区域的读写访问子规则；所述存储器每个区域的读写访问子规则，用于设置存储器对应区域的读写权限，在所述存储器访问命令与存储器访问地址所在区域的读写权限相匹配时，允许对存储器进行访问；在所述存储器访问命令与存储器访问地址所在区域的读写权限不匹配时，不允许对存储器进行访问。
具体地，所设置的存储器每个区域的读写权限可以是只读、只写、可读写或不能读写，当所述存储器访问命令为读访问命令，且存储器访问地址所在区域的读写权限是只读或可读写时，所述存储器访问命令与存储器访问地址所在区域的读写权限相匹配，此时，允许对存储器进行访问；当所述存储器访问命令为读访问命令，且存储器访问地址所在区域的读写权限是只写或不能读写时，所述存储器访问命令与存储器访问地址所在区域的读写权限不匹配，此时，不允许对存储器进行访问。
当所述存储器访问命令为写访问命令，且存储器访问地址所在区域的读写权限是只写或可读写时，所述存储器访问命令与存储器访问地址所在区域的读写权限相匹配，此时，允许对存储器进行访问；当所述存储器访 问命令为写访问命令，且存储器访问地址所在区域的读写权限是只读或不能读写时，所述存储器访问命令与存储器访问地址所在区域的读写权限不匹配，此时，不允许对存储器进行访问。
可以看出，如果预先设置的访问规则包括ID访问规则和读写访问规则，可以实现存储器每个区域对不同的ID具有不同的读写权限。
所述保护规则，包括存储器每个区域的保护子规则；所述存储器每个区域的保护子规则，用于设置存储器对应区域的保护标识，在存储器访问地址处于存储器对应区域，且访问指示标识与存储器访问地址所在区域的保护标识相匹配时，允许对存储器进行访问；在存储器访问地址处于存储器对应区域，且访问指示标识与存储器访问地址所在区域的保护标识不匹配时，不允许对存储器进行访问；这里，所述访问指示标识为读访问命令中的读访问指示标识或写访问命令中的写访问指示标识。
例如，存储器每个区域的保护标识可以分为四种，第一种保护标识包括安全标识和特权标识，第二种保护标识只包括安全标识，第三种保护标识只包括特权标识，第四种保护标识为无标识。这里，将具有第一种保护标识的区域称为特权安全区域，将具有第二种保护标识的区域称为一般安全区域，将具有第三种保护标识的区域称为特权普通区域，将具有第四种保护标识的区域称为一般普通区域。如果读访问指示标识或写访问指示标识包括安全标识和特权标识，则可以访问特权安全区域、一般安全区域、特权普通区域或一般普通区域；如果读访问指示标识或写访问指示标识只包括安全标识，则可以访问一般安全区域或一般普通区域；如果读访问指示标识或写访问指示标识只包括特权标识，则可以访问特权普通区域或一般普通区域；如果读访问指示标识或写访问指示标识不包括任何标识，则可以访问一般普通区域。
需要说明的是，存储器每个区域只设置一个保护标识，存储器中每个 地址的保护标识为相应地址所处在的区域的保护标识，也就是说，存储器每个区域中，每个地址的保护标识相同。
本步骤中，当所述预先设置的访问规则中的每种规则均允许对存储器进行访问时，确定具有访问存储器的权限；当所述预先设置的访问规则中的至少一种规则不允许对存储器进行访问时，确定没有访问存储器的权限。
本步骤中，ID访问规则、读写访问规则和保护规则可灵活配合使用，实现有效、功能丰富的存储器访问控制策略。
步骤102：确定具有访问存储器的权限时，将待写入存储器的数据进行加密后写入存储器，或者从存储器中读取数据并对读取出的数据进行解密。
具体地说，将待写入存储器的数据进行加密后写入存储器包括：将待写入存储器的数据通过预设的密钥加密为密文，将密文发送至存储器。从存储器中读取数据并对读取出的数据进行解密包括：在存储器中读取密文，将密文通过预设的密钥进行解密。可以看出，本步骤支持对写入到存储器中数据进行加密并支持对从存储器读取出的数据进行解密，可以通过数据加密防御存储器数据被窃取。
本步骤中，可以采用高级加密标准(AES，Advanced Encryption Standard，)/数据加密标准(DES，Data Encryption Standard)等加解密算法对数据进行加解密；通过高性能的AES/DES等加解密算法，对写入存储器的数据加密，即使存储器中的数据被非法获取也无法破解，读取存储器的数据时进行对应的解密。高性能的加解密算法可保证加解密的实时性、减少读写延迟。另外，本步骤中的加密算法与解密算法需保持一致。
现有技术在对从存储器读取的数据或写入存储器的数据进行解加密时，通常采用以下两种方法来实现：第一种方法，采用软件解加密方式进行解加密；第二种方法，采用直接内存访问(DMA，Direct Memory Access)方式将相应数据调用至解加密模块，从而进行硬件解加密。然而，在采用 第一种方法进行数据解加密时，软件解加密的处理效率较低；在采用第二种方法进行数据解加密时，由于采用DMA方式来调用数据，会占用存储器访问总线带宽，导致消耗较多的总线带宽资源。
相应地，本步骤可以采用在线(In-line)加密的方式来对待写入存储器的数据进行加密，可以采用在线解密的方式对从存储器中读取出的数据进行解密。相比现有的两种加解密的方式，采用在线加解密方式，可以节省总线带宽及硬件开销，并降低功耗。
在一实施方式中，在将待写入存储器的数据进行加密后，将加密后的密文发送至存储器控制器，通过存储器控制器实现对存储器数据的写入。在从存储器中读取数据时，通过存储器控制器将相应的密文读出。这里，存储器控制器可以是DRAM控制器、SRAM控制器或闪存控制器。
本发明的存储器访问控制方法的第一实施例，可以支持多种安全控制策略，所有经过本装置的存储器访问都要经过安全权限检查，这些安全控制策略和权限检查符合ARM TrustZone可信架构中多媒体保护对于存储器安全访问的要求。
第二实施例
为了能更加体现本发明的目的，在本发明第一实施例的基础上，进行进一步的举例说明。
本发明存储器访问控制方法的第二实施例中，存储器访问命令为写访问命令，在获取存储器访问命令之后，采用方法二来确定是否具有访问存储器的权限。
图2为本发明存储器访问控制方法的第二实施例的流程图，如图2所示，该方法包括：
步骤200：配置访问控制参数。
这里，访问控制参数包括区域控制参数、ID控制参数、读写控制参数、 保护控制参数和加解密参数。
本步骤中，区域控制参数包括存储器所划分的区域个数和区域大小；ID控制参数包括存储器每个区域的ID访问参数，存储器每个区域的ID访问参数包括能够访问存储器对应区域的ID；读写控制参数包括存储器每个区域的读写权限；保护控制参数包括存储器每个区域的保护标识；加解密参数包括加密方式和密钥。
步骤201：接收存储器访问命令和待写入存储器的数据。
这里，存储器访问命令为写访问命令，本步骤中，可以通过总线接收来自主设备的写访问命令和待写入存储器的数据。
步骤202：基于所述存储器访问命令，确定是否具有访问存储器的权限。
本步骤与步骤101的实现过程相同，这里不再详述。
步骤203：确定具有访问存储器的权限时，根据加解密参数，将待写入存储器的数据加密为密文。
步骤204：将写访问命令和密文按照总线协议封装，将封装后的数据发送到存储器。
第三实施例
为了能更加体现本发明的目的，在本发明第一实施例的基础上，进行进一步的举例说明。
本发明存储器访问控制方法的第三实施例中，存储器访问命令为读访问命令，在获取存储器访问命令之后，采用方法二来确定是否具有访问存储器的权限。
图3为本发明存储器访问控制方法的第三实施例的流程图，如图3所示，该方法包括：
步骤300：配置访问控制参数。
这里，访问控制参数包括区域控制参数、ID控制参数、读写控制参数、 保护控制参数和加解密参数。
本步骤中，区域控制参数包括存储器所划分的区域个数和区域大小；ID控制参数包括存储器每个区域的ID访问参数，存储器每个区域的ID访问参数包括能够访问存储器对应区域的ID；读写控制参数包括存储器每个区域的读写权限；保护控制参数包括存储器每个区域的保护标识；加解密参数包括解密方式和密钥。
步骤301：接收存储器访问命令。
这里，存储器访问命令为读访问命令，本步骤中，可以通过总线接收来自主设备的读访问命令。
步骤302：基于所述存储器访问命令，确定是否具有访问存储器的权限。
本步骤与步骤101的实现过程相同，这里不再详述。
步骤303：确定具有访问存储器的权限时，从存储器中读出密文。
步骤304：根据加解密参数，对密文进行解密。
第四实施例
基于本发明存储器访问控制方法的实施例，本发明实施例还提供了一种存储器访问控制装置。
图4为本发明实施例存储器访问控制装置的组成结构示意图，如图4所示，该装置包括：从机接口模块400、访问控制模块401、加解密模块402和主机接口模块403；其中，
从机接口模块400，配置为获取存储器访问命令。
访问控制模块401，配置为基于所述存储器访问命令，确定是否具有访问存储器的权限。
加解密模块402，配置为对从存储器中读取的数据进行解密，或者在确定具有访问存储器的权限时，将待写入存储器的数据进行加密。
主机接口模块403，配置为将加密后的待写入存储器的数据写入存储 器，或者在确定具有访问存储器的权限时，从存储器中读取数据。
所述访问控制模块401，还配置为基于所述存储器访问命令和预先设置的访问规则，确定是否具有访问存储器的权限。
所述存储器访问命令包括存储器访问地址，还包括以下至少一种信息：访问源的ID、访问指示标识，所述存储器访问地址为所要读取的数据在存储器中的地址或存储器的数据写入地址；所述访问指示标识为读访问指示标识或写访问指示标识。
所述预先设置的访问规则包括以下至少一种规则：ID访问规则、读写访问规则、保护规则。
所述ID访问规则，用于在所述访问源的ID属于能够访问存储器的ID时，允许对存储器进行访问；在所述访问源的ID不属于能够访问存储器的ID时，不允许对存储器进行访问。
所述读写访问规则，用于设置存储器的读写权限，在所述存储器访问命令与所设置的存储器的读写权限相匹配时，允许对存储器进行访问；在所述存储器访问命令与所设置的存储器的读写权限不匹配时，不允许对存储器进行访问；
所述保护规则，用于设置存储器的保护标识，在读访问指示标识与存储器的保护标识相匹配时，或者在写访问指示标识与存储器的保护标识相匹配时，允许对存储器进行访问；在存储器访问命令为读访问命令，且读访问指示标识与存储器的保护标识不匹配时，不允许对存储器进行访问；在存储器访问命令为写访问命令，且写访问指示标识与存储器的保护标识不匹配时，不允许对存储器进行访问。
所述访问控制模块401，还配置为在确定是否具有访问存储器的权限之前，按照存储器的地址将存储器划分为多个区域。
所述存储器访问命令包括存储器访问地址，还包括以下至少一种信息： 访问源的ID、访问指示标识，所述存储器访问地址为所要读取的数据在存储器中的地址或存储器的数据写入地址；所述访问指示标识为读访问指示标识或写访问指示标识。
所述预先设置的访问规则包括以下至少一种规则：ID访问规则、读写访问规则、保护规则。
所述ID访问规则，包括存储器每个区域的ID访问子规则；所述存储器每个区域的ID访问子规则，用于在存储器访问地址处于存储器对应区域，且访问源的ID属于能够访问存储器对应区域的ID时，允许对存储器进行访问；在存储器访问地址处于存储器对应区域，且访问源的ID不属于能够访问存储器对应区域的ID时，不允许对存储器进行访问。
所述读写访问规则，包括存储器每个区域的读写访问子规则；所述存储器每个区域的读写访问子规则，用于设置存储器对应区域的读写权限，在所述存储器访问命令与存储器访问地址所在区域的读写权限相匹配时，允许对存储器进行访问；在所述存储器访问命令与存储器访问地址所在区域的读写权限不匹配时，不允许对存储器进行访问。
所述保护规则，包括存储器每个区域的保护子规则；所述存储器每个区域的保护子规则，用于设置存储器对应区域的保护标识，在存储器访问地址处于存储器对应区域，且访问指示标识与存储器访问地址所在区域的保护标识相匹配时，允许对存储器进行访问；在存储器访问地址处于存储器对应区域，且访问指示标识与存储器访问地址所在区域的保护标识不匹配时，不允许对存储器进行访问。
所述访问控制模块401，还配置为在所述预先设置的访问规则中的每种规则均允许对存储器进行访问时，确定具有访问存储器的权限。
所述加解密模块402，还配置为采用AES或DES加密算法对待写入存储器的数据进行加密，或者采用AES或DES解密算法对从存储器中读取的 数据进行解密。
所述加解密模块402，还配置为采用在线解密方式对从存储器中读取的数据进行解密，或者采用在线加密方式对待写入存储器的数据进行加密。
如图4所示，本发明实施例存储器访问控制装置还包括处理器接口模块404和控制单元模块405；其中，
处理器接口模块404，配置为接收访问控制参数，并将访问控制参数发送至控制单元模块；这里，访问控制参数的具体内容已经在本发明存储器访问控制方法的各种实施例中作出说明，这里不再详述。
处理器接口模块404，还配置为接收来自控制单元模块的状态参数，这里，控制单元模块的状态参数，用于表明当前控制单元的工作状态。
在一实施方式中，处理器接口模块404可以通过AXI、AHB和APB等总线协议来接收访问控制参数，处理器接口接收外部设备如处理器的访问控制参数时，只有当外部设备对处理器接口模块的访问为安全访问时，处理器接口模块才接收访问控制参数，否则，当外部设备对处理器接口模块的访问为非安全访问时，处理器接口模块不接收访问控制参数，这时，处理器接口模块向外部设备返回错误响应和中断。如此，可以使本发明实施例存储器访问控制装置处在安全区域，可以满足ARM TrustZone可信架构的要求中安全控制逻辑只能安全访问的要求。
所述控制单元模块405，配置为根据接收的访问控制参数，对访问控制模块和加解密模块进行控制；具体地说，控制单元模块将访问控制参数中的加解密参数发送至加解密模块，将访问控制参数中的其他参数发送至访问控制模块；如此，利用控制单元模块和加解密模块，既可以实现数据的加解密控制，利用控制单元模块和访问控制模块，既可以实现多种访问控制策略。
所述从机接口模块400，配置为实现本发明实施例存储器访问控制装置 与主设备的数据交互；从机接口模块在接收到读访问命令时，将读访问命令发送至访问控制模块；从机接口模块在接收到写访问命令和待写入存储器的数据时，将写访问命令发送至访问控制模块，将待写入存储器的数据发送至加解密模块。
所述访问控制模块401，还配置为在接收到写访问命令时，基于所述写访问命令，确定是否具有访问存储器的权限；在确定具有访问存储器的权限时，分别发送写访问允许指令到加解密模块和从机接口模块，并将写访问命令发送至主机接口模块；在确定没有访问存储器的权限时，分别发送写访问拒绝指令到加解密模块和从机接口模块，此时不会发送写访问命令发送至主机接口模块。
所述从机接口模块400，配置为在收到写访问允许指令后，发送写访问成功响应到主设备；所述从机接口模块在收到写访问拒绝指令后，发送写访问出错响应到主设备。
所述加解密模块402，配置为在收到写访问允许指令后，根据加解密参数，对待写入存储器的数据进行加密，并将加密后的密文发送至主机接口模块；所述加解密模块在收到写访问拒绝指令后，不对待写入存储器的数据作任何处理。
所述主机接口模块403，配置为按照总线协议，将接收的写访问命令和密文进行封装，并将封装后的数据发送至存储器。具体地说，主机接口模块将封装后的数据发送至存储器控制器，存储器控制器根据封装后的数据，将密文写入到存储器中。
所述访问控制模块401，还配置为在接收到读访问命令时，基于所述读访问命令，确定是否具有访问存储器的权限；在确定具有访问存储器的权限时，分别发送读访问允许指令到加解密模块和从机接口模块，并将读访问命令发送至主机接口模块；在确定没有访问存储器的权限时，分别发送 读访问拒绝指令到加解密模块和从机接口模块，此时不会发送读访问命令发送至主机接口模块。
所述从机接口模块400，配置为在收到读访问拒绝指令后，发送读访问出错响应到主设备。
所述主机接口模块403，配置为按照总线协议和接收的读访问命令，从存储器中读取相应的密文，并将读取出的密文发送至加解密模块。具体地说，主机接口模块利用存储器控制来读取存储器存储的密文。
所述加解密模块402，配置为在收到读访问允许指令后，根据加解密参数，对接收的密文进行解密，并将解密后的数据发送至从机接口，
所述从机接口模块400，配置为在收到解密后的数据时，将解密后的数据和读访问成功相应发送至主设备。
这里，主机接口模块可以通过AXI、AHB和APB等总线协议与存储器控制器实现数据交互。
需要说明的是，本发明实施例存储器访问控制装置可以支持多个主设备的接入，在有多个主设备接入时，为每个主设备相应设置一个从机接口模块、一个访问控制模块、一个解加密模块和一个主机接口模块，这里，可以使用一个控制单元模块实现对各个访问控制模块和各个主机接口模块的控制。
在实际应用中，所述从机接口模块400、访问控制模块401、加解密模块402、主机接口模块403、处理器接口模块404和控制单元模块405均可由位于终端设备中的中央处理器(Central Processing Unit，CPU)、微处理器(Micro Processor Unit，MPU)、数字信号处理器(Digital Signal Processor，DSP)、或现场可编程门阵列(Field Programmable Gate Array，FPGA)等实现。
本发明实施例上述存储器访问控制装置如果以软件功能模块的形式实 现并作为独立的产品销售或使用时，也可以存储在一个计算机可读取存储介质中。基于这样的理解，本发明实施例的技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机、服务器、或者网络设备等)执行本发明各个实施例所述方法的全部或部分。而前述的存储介质包括：U盘、移动硬盘、只读存储器(ROM，Read Only Memory)、磁碟或者光盘等各种可以存储程序代码的介质。这样，本发明实施例不限制于任何特定的硬件和软件结合。
相应地，本发明实施例还提供一种计算机存储介质，其中存储有计算机程序，该计算机程序用于执行本发明实施例的存储器访问控制方法。
本领域内的技术人员应明白，本发明的实施例可提供为方法、系统、或计算机程序产品。因此，本发明可采用硬件实施例、软件实施例、或结合软件和硬件方面的实施例的形式。而且，本发明可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器和光学存储器等)上实施的计算机程序产品的形式。
本发明是参照根据本发明实施例的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存 储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
以上所述，仅为本发明的较佳实施例而已，并非用于限定本发明的保护范围。
工业实用性
本发明实施例的技术方案，获取存储器访问命令；基于所述存储器访问命令，确定是否具有访问存储器的权限；确定具有访问存储器的权限时，将待写入存储器的数据进行加密后写入存储器，或者从存储器中读取数据并对读取出的数据进行解密。如此，通过设置至少两种访问控制策略，可以提高存储器访问的安全性。

Claims (15)

  1. 一种存储器访问控制方法，所述方法包括：
    获取存储器访问命令；
    基于所述存储器访问命令，确定是否具有访问存储器的权限；
    确定具有访问存储器的权限时，将待写入存储器的数据进行加密后写入存储器，或者从存储器中读取数据并对读取出的数据进行解密。
  2. 根据权利要求1所述的方法，其中，所述基于所述存储器访问命令，确定是否具有访问存储器的权限，包括：基于所述存储器访问命令和预先设置的访问规则，确定是否具有访问存储器的权限。
  3. 根据权利要求2所述的方法，其中，所述存储器访问命令包括以下至少一种信息：访问源的ID、访问指示标识，所述访问指示标识为读访问指示标识或写访问指示标识；
    所述预先设置的访问规则包括以下至少一种规则：ID访问规则、读写访问规则、保护规则；
    所述ID访问规则，用于在所述访问源的ID属于能够访问存储器的ID时，允许对存储器进行访问；在所述访问源的ID不属于能够访问存储器的ID时，不允许对存储器进行访问；
    所述读写访问规则，用于设置存储器的读写权限，在所述存储器访问命令与所设置的存储器的读写权限相匹配时，允许对存储器进行访问；在所述存储器访问命令与所设置的存储器的读写权限不匹配时，不允许对存储器进行访问；
    所述保护规则，用于设置存储器的保护标识，在读访问指示标识与存储器的保护标识相匹配时，或者在写访问指示标识与存储器的保护标识相匹配时，允许对存储器进行访问；在存储器访问命令为读访问命令，且读访问指示标识与存储器的保护标识不匹配时，不允许对存储器进行访问； 在存储器访问命令为写访问命令，且写访问指示标识与存储器的保护标识不匹配时，不允许对存储器进行访问。
  4. 根据权利要求2所述的方法，其中，在确定是否具有访问存储器的权限之前，所述方法还包括按照存储器的地址将存储器划分为多个区域；
    所述存储器访问命令包括存储器访问地址，还包括以下至少一种信息：访问源的ID、访问指示标识，所述存储器访问地址为所要读取的数据在存储器中的地址或存储器的数据写入地址；所述访问指示标识为读访问指示标识或写访问指示标识；
    所述预先设置的访问规则包括以下至少一种规则：ID访问规则、读写访问规则、保护规则；
    所述ID访问规则，包括存储器每个区域的ID访问子规则；所述存储器每个区域的ID访问子规则，用于在存储器访问地址处于存储器对应区域，且访问源的ID属于能够访问存储器对应区域的ID时，允许对存储器进行访问；在存储器访问地址处于存储器对应区域，且访问源的ID不属于能够访问存储器对应区域的ID时，不允许对存储器进行访问；
    所述读写访问规则，包括存储器每个区域的读写访问子规则；所述存储器每个区域的读写访问子规则，用于设置存储器对应区域的读写权限，在所述存储器访问命令与存储器访问地址所在区域的读写权限相匹配时，允许对存储器进行访问；在所述存储器访问命令与存储器访问地址所在区域的读写权限不匹配时，不允许对存储器进行访问；
    所述保护规则，包括存储器每个区域的保护子规则；所述存储器每个区域的保护子规则，用于设置存储器对应区域的保护标识，在存储器访问地址处于存储器对应区域，且访问指示标识与存储器访问地址所在区域的保护标识相匹配时，允许对存储器进行访问；在存储器访问地址处于存储器对应区域，且访问指示标识与存储器访问地址所在区域的保护标识不匹 配时，不允许对存储器进行访问。
  5. 根据权利要求3或4所述的方法，其中，当所述预先设置的访问规则中的每种规则均允许对存储器进行访问时，确定具有访问存储器的权限。
  6. 根据权利要求1至4任一项所述的方法，其中，所述将待写入存储器的数据进行加密后写入存储器包括：采用高级加密标准AES或数据加密标准DES加密算法对待写入存储器的数据进行加密，将加密后的密文写入存储器；
    所述从存储器中读取数据并对读取出的数据进行解密，包括：采用AES或DES解密算法对从存储器中读取出的数据进行解密。
  7. 根据权利要求1至4任一项所述的方法，其中，所述将待写入存储器的数据进行加密后写入存储器包括：采用在线加密方式对待写入存储器的数据进行加密；
    所述从存储器中读取数据并对读取出的数据进行解密，包括：采用在线解密方式对从存储器中读取出的数据进行解密。
  8. 一种存储器访问控制装置，所述装置包括：从机接口模块、访问控制模块、加解密模块和主机接口模块；其中，
    从机接口模块，配置为获取存储器访问命令；
    访问控制模块，配置为基于所述存储器访问命令，确定是否具有访问存储器的权限；
    加解密模块，配置为对从存储器中读取的数据进行解密，或者在确定具有访问存储器的权限时，将待写入存储器的数据进行加密；
    主机接口模块，配置为将加密后的待写入存储器的数据写入存储器，或者在确定具有访问存储器的权限时，从存储器中读取数据。
  9. 根据权利要求8所述的装置，其中，所述访问控制模块，还配置为基于所述存储器访问命令和预先设置的访问规则，确定是否具有访问存储 器的权限。
  10. 根据权利要求9所述的装置，其中，所述存储器访问命令包括以下至少一种信息：访问源的ID、访问指示标识，所述访问指示标识为读访问指示标识或写访问指示标识；
    所述预先设置的访问规则包括以下至少一种规则：ID访问规则、读写访问规则、保护规则；
    所述ID访问规则，用于在所述访问源的ID属于能够访问存储器的ID时，允许对存储器进行访问；在所述访问源的ID不属于能够访问存储器的ID时，不允许对存储器进行访问；
    所述读写访问规则，用于设置存储器的读写权限，在所述存储器访问命令与所设置的存储器的读写权限相匹配时，允许对存储器进行访问；在所述存储器访问命令与所设置的存储器的读写权限不匹配时，不允许对存储器进行访问；
    所述保护规则，用于设置存储器的保护标识，在读访问指示标识与存储器的保护标识相匹配时，或者在写访问指示标识与存储器的保护标识相匹配时，允许对存储器进行访问；在存储器访问命令为读访问命令，且读访问指示标识与存储器的保护标识不匹配时，不允许对存储器进行访问；在存储器访问命令为写访问命令，且写访问指示标识与存储器的保护标识不匹配时，不允许对存储器进行访问。
  11. 根据权利要求9所述的装置，其中，所述访问控制模块，还配置为在确定是否具有访问存储器的权限之前，按照存储器的地址将存储器划分为多个区域；
    所述存储器访问命令包括存储器访问地址，还包括以下至少一种信息：访问源的ID、访问指示标识，所述存储器访问地址为所要读取的数据在存储器中的地址或存储器的数据写入地址；所述访问指示标识为读访问指示 标识或写访问指示标识；
    所述预先设置的访问规则包括以下至少一种规则：ID访问规则、读写访问规则、保护规则；
    所述ID访问规则，包括存储器每个区域的ID访问子规则；所述存储器每个区域的ID访问子规则，用于在存储器访问地址处于存储器对应区域，且访问源的ID属于能够访问存储器对应区域的ID时，允许对存储器进行访问；在存储器访问地址处于存储器对应区域，且访问源的ID不属于能够访问存储器对应区域的ID时，不允许对存储器进行访问；
    所述读写访问规则，包括存储器每个区域的读写访问子规则；所述存储器每个区域的读写访问子规则，用于设置存储器对应区域的读写权限，在所述存储器访问命令与存储器访问地址所在区域的读写权限相匹配时，允许对存储器进行访问；在所述存储器访问命令与存储器访问地址所在区域的读写权限不匹配时，不允许对存储器进行访问；
    所述保护规则，包括存储器每个区域的保护子规则；所述存储器每个区域的保护子规则，用于设置存储器对应区域的保护标识，在存储器访问地址处于存储器对应区域，且访问指示标识与存储器访问地址所在区域的保护标识相匹配时，允许对存储器进行访问；在存储器访问地址处于存储器对应区域，且访问指示标识与存储器访问地址所在区域的保护标识不匹配时，不允许对存储器进行访问。
  12. 根据权利要求10或11所述的装置，其中，所述访问控制模块，还配置为在所述预先设置的访问规则中的每种规则均允许对存储器进行访问时，确定具有访问存储器的权限。
  13. 根据权利要求8至11任一项所述的装置，其中，所述加解密模块，还配置为采用高级加密标准AES或数据加密标准DES加密算法对待写入存储器的数据进行加密，或者采用AES或DES解密算法对从存储器中读取的 数据进行解密。
  14. 根据权利要求8至11任一项所述的装置，其中，所述加解密模块，还配置为采用在线解密方式对从存储器中读取的数据进行解密，或者采用在线加密方式对待写入存储器的数据进行加密。
  15. 一种计算机存储介质，所述计算机存储介质中存储有计算机可执行指令，该计算机可执行指令配置为执行权利要求1-7任一项所述的存储器访问控制方法。
PCT/CN2016/089492 2015-08-20 2016-07-08 一种存储器访问控制方法和装置、计算机存储介质 WO2017028642A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510516312.2 2015-08-20
CN201510516312.2A CN106469124A (zh) 2015-08-20 2015-08-20 一种存储器访问控制方法和装置

Publications (1)

Publication Number Publication Date
WO2017028642A1 true WO2017028642A1 (zh) 2017-02-23

Family

ID=58051963

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/089492 WO2017028642A1 (zh) 2015-08-20 2016-07-08 一种存储器访问控制方法和装置、计算机存储介质

Country Status (2)

Country Link
CN (1) CN106469124A (zh)
WO (1) WO2017028642A1 (zh)

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108062486A (zh) * 2017-12-15 2018-05-22 杭州中天微系统有限公司 一种针对间接访问存储控制器的存储保护装置
CN108197503A (zh) * 2017-12-15 2018-06-22 杭州中天微系统有限公司 一种为间接访问存储控制器增加保护功能的装置
CN113486410A (zh) * 2021-06-30 2021-10-08 海光信息技术股份有限公司 一种保护数据安全的方法、cpu核、cpu芯片和电子设备
CN116595594A (zh) * 2023-05-19 2023-08-15 无锡摩芯半导体有限公司 一种基于ucb的flash的安全控制方法

Families Citing this family (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109391843B (zh) * 2017-08-03 2022-02-25 腾讯科技（深圳）有限公司 在线视频倍速播放方法、装置、介质及智能终端
CN109784098B (zh) * 2019-01-23 2023-01-17 湖南国科微电子股份有限公司 一种ai加速器的加密装置及其数据处理方法
CN111950017B (zh) * 2019-05-14 2023-05-16 龙芯中科技术股份有限公司 内存数据保护方法、装置、设备以及存储介质
WO2020248088A1 (zh) * 2019-06-10 2020-12-17 华为技术有限公司 安全访问方法及电子设备
CN112443952A (zh) * 2019-08-30 2021-03-05 广东美的制冷设备有限公司 家用电器共享的方法、共享终端与终端设备
CN111881435B (zh) * 2020-08-03 2023-11-24 沈阳谦川科技有限公司 一种安全内存实现方法及其系统
WO2022126644A1 (zh) * 2020-12-18 2022-06-23 华为技术有限公司 模型保护装置及方法、计算装置
CN114580005B (zh) * 2022-05-09 2023-02-28 深圳市航顺芯片技术研发有限公司 数据访问方法、计算机设备及可读存储介质
CN117785756B (zh) * 2024-02-23 2024-05-28 西安简矽技术有限公司 存储器控制系统、方法、芯片及计算机可读存储介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1764908A (zh) * 2003-03-26 2006-04-26 松下电器产业株式会社 存储装置
US20130073872A1 (en) * 2011-09-15 2013-03-21 Sony Corporation Information processing apparatus, information processing method and program
CN103617404A (zh) * 2013-12-17 2014-03-05 天津赢达信科技有限公司 一种安全分区的存储装置
CN104615953A (zh) * 2015-02-10 2015-05-13 复旦大学 一种配置数据流安全性高的可编程逻辑器

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP4883728B2 (ja) * 2009-06-26 2012-02-22 株式会社バッファロー ストレージ装置、ストレージ装置の制御方法、およびコンピュータプログラム
CN102014133B (zh) * 2010-11-26 2013-08-21 清华大学 在云存储环境下一种安全存储系统的实现方法

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1764908A (zh) * 2003-03-26 2006-04-26 松下电器产业株式会社 存储装置
US20130073872A1 (en) * 2011-09-15 2013-03-21 Sony Corporation Information processing apparatus, information processing method and program
CN103617404A (zh) * 2013-12-17 2014-03-05 天津赢达信科技有限公司 一种安全分区的存储装置
CN104615953A (zh) * 2015-02-10 2015-05-13 复旦大学 一种配置数据流安全性高的可编程逻辑器

Cited By (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108062486A (zh) * 2017-12-15 2018-05-22 杭州中天微系统有限公司 一种针对间接访问存储控制器的存储保护装置
CN108197503A (zh) * 2017-12-15 2018-06-22 杭州中天微系统有限公司 一种为间接访问存储控制器增加保护功能的装置
WO2019114820A1 (en) * 2017-12-15 2019-06-20 C-Sky Microsystems Co., Ltd. Memory protective apparatus for indirect access memory controller
CN108062486B (zh) * 2017-12-15 2020-09-15 杭州中天微系统有限公司 一种针对间接访问存储控制器的存储保护装置
CN108197503B (zh) * 2017-12-15 2020-09-15 杭州中天微系统有限公司 一种为间接访问存储控制器增加保护功能的装置
US11216192B2 (en) 2017-12-15 2022-01-04 C-Sky Microsystems Co., Ltd. Memory protective apparatus for indirect access memory controller
US11256830B2 (en) 2017-12-15 2022-02-22 C-Sky Microsystems Co., Ltd. Apparatus for adding protection function for indirect access memory controller
US11726675B2 (en) 2017-12-15 2023-08-15 C-Sky Microsystems Co., Ltd. Memory protective apparatus for indirect access memory controller
CN113486410A (zh) * 2021-06-30 2021-10-08 海光信息技术股份有限公司 一种保护数据安全的方法、cpu核、cpu芯片和电子设备
CN113486410B (zh) * 2021-06-30 2023-11-21 海光信息技术股份有限公司 一种保护数据安全的方法、cpu核、cpu芯片和电子设备
CN116595594A (zh) * 2023-05-19 2023-08-15 无锡摩芯半导体有限公司 一种基于ucb的flash的安全控制方法

Also Published As

Publication number Publication date
CN106469124A (zh) 2017-03-01

Similar Documents

Publication Publication Date Title
WO2017028642A1 (zh) 一种存储器访问控制方法和装置、计算机存储介质
US20230110230A1 (en) Technologies for secure i/o with memory encryption engines
CN109844751B (zh) 用于提供信息隔离的方法和处理器
JP6804665B2 (ja) ハイパーバイザと仮想マシンとの間のメモリページ遷移の監視
US8572410B1 (en) Virtualized protected storage
EP3326103B1 (en) Technologies for trusted i/o for multiple co-existing trusted execution environments under isa control
CN104392188B (zh) 一种安全数据存储方法和系统
US9811478B2 (en) Self-encrypting flash drive
US20170277898A1 (en) Key management for secure memory address spaces
US9607177B2 (en) Method for securing content in dynamically allocated memory using different domain-specific keys
TWI514187B (zh) 提供儲存裝置上防有毒軟體保護之系統與方法
WO2017041603A1 (zh) 数据加密方法、装置及移动终端、计算机存储介质
US10417433B2 (en) Encryption and decryption of data owned by a guest operating system
CN108090366B (zh) 数据保护方法及装置、计算机装置及可读存储介质
KR20150041095A (ko) 선택적 ram 스크램블링을 위한 방법 및 디바이스들
WO2016146013A1 (zh) 在数字内容设备中在线写入应用密钥的方法、装置及系统
JP2013232219A (ja) マイクロコントローラにおけるデータの安全な取扱いのための方法および装置
US10225247B2 (en) Bidirectional cryptographic IO for data streams
TW201530344A (zh) 應用程式存取保護方法及應用程式存取保護裝置
US11748493B2 (en) Secure asset management system
KR101653193B1 (ko) 보안 처리 환경으로부터의 기능의 오프로딩
WO2021218278A1 (zh) 数据处理的方法以及计算设备
US11531626B2 (en) System and method to protect digital content on external storage
TW202008744A (zh) 動態密碼密鑰擴展
US9122504B2 (en) Apparatus and method for encryption in virtualized environment using auxiliary medium

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16836506

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 16836506

Country of ref document: EP

Kind code of ref document: A1